You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> If you want to fully audit how controlled folder access will work in your organization, use a management tool to deploy this setting to devices in your networks. You can also use Group Policy, Intune, mobile device management (MDM), or Microsoft Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders.md).
55
-
56
53
> [!NOTE]
57
-
> - If your workflow involves usage of shared network folders, enabling controlled folder access can result in significant performance reduction, particularly because of many queries to the file share server.
58
-
> - Some types of endpoint security or asset management software inject code into every process that starts on the system. These may result in controlled folder access no longer trusting known applications like Office programs. You can see the reason for controlled folder access detections by using the MDEClientAnalyzer tool's `-cfa` argument (see [Run the client analyzer on Windows](run-analyzer-windows.md)). If you're affected, consider adding an [antivirus exclusion](configure-exclusions-microsoft-defender-antivirus.md) for the injecting process, or consult your management software vendor about signing all their binaries.
54
+
> - To see how controlled folder access would work in your organization, use a management tool to deploy it to devices in your network. You can also use Group Policy, Intune, mobile device management (MDM), or Microsoft Configuration Manager to configure and deploy the setting, as described in [Protect important folders with controlled folder access](controlled-folders.md).
55
+
>
56
+
> - If your workflow involves usage of shared network folders, enabling controlled folder access can result in significant network performance reduction, if the shared network folders are accessed by an untrusted process, particularly because of many queries to the file share server. Make sure your file servers are optimized for increased network traffic, especially if you're using shared network folders for offline files.
57
+
>
58
+
> - Some types of endpoint security or asset management software inject code into every process that starts on the system. These may result in controlled folder access no longer trusting known applications like Office programs. You can see the reason for controlled folder access detections by using the [MDEClientAnalyzer](run-analyzer-windows.md) tool's `-cfa` argument. If you're affected, consider adding an [antivirus exclusion](configure-exclusions-microsoft-defender-antivirus.md) for the injecting process, or consult your management software vendor about signing all their binaries.
59
59
60
60
## Review controlled folder access events in Windows Event Viewer
Maximize available security capabilities and better protect your enterprise from cyber threats by deploying Microsoft Defender for Endpoint and onboarding your devices. Onboarding your devices enables you to identify and stop threats quickly, prioritize risks, and evolve your defenses across operating systems and network devices.
38
37
39
38
This guide provides five steps to help deploy Defender for Endpoint as your multi-platform endpoint protection solution. It helps you choose the best deployment tool, onboard devices, and configure capabilities. Each step corresponds to a separate article.
@@ -48,13 +47,16 @@ The steps to deploy Defender for Endpoint are:
48
47
4.[Step 4 - Onboard devices](onboarding.md): Assess and onboard your devices to Defender for Endpoint.
49
48
5.[Step 5 - Configure capabilities](onboard-configure.md): You're now ready to configure Defender for Endpoint security capabilities to protect your devices.
50
49
50
+
> [!IMPORTANT]
51
+
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
52
+
51
53
## Requirements
52
54
53
55
Here's a list of prerequisites required to deploy Defender for Endpoint:
54
56
55
-
- You're a global admin
57
+
- You're a Global Administrator
56
58
- Your environment meets the [minimum requirements](minimum-requirements.md)
57
-
- You have a full inventory of your environment. The following table provides a starting point to gather information and ensure your environment is deeply understood by stakeholders, which helps identify potential dependencies and/or changes required in technologies or processes.
59
+
- You have a full inventory of your environment. The following table provides a starting point to gather information and ensure that stakeholders understand your environment. The inventory helps identify potential dependencies and/or changes required in technologies or processes.
Copy file name to clipboardExpand all lines: defender-endpoint/prepare-deployment.md
+9-10Lines changed: 9 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.collection:
16
16
ms.topic: conceptual
17
17
ms.subservice: onboard
18
18
search.appverid: met150
19
-
ms.date: 12/18/2020
19
+
ms.date: 06/26/2024
20
20
---
21
21
22
22
# Assign roles and permissions for Microsoft Defender for Endpoint deployment
@@ -31,24 +31,22 @@ ms.date: 12/18/2020
31
31
32
32
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
33
33
34
-
The next step when deploying Defender for Endpoint is to assign roles and permissions for The Defender for Endpoint deployment.
34
+
The next step when deploying Defender for Endpoint is to assign roles and permissions for the Defender for Endpoint deployment.
35
+
36
+
> [!IMPORTANT]
37
+
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
35
38
36
39
## Role-based access control
37
40
38
41
Microsoft recommends using the concept of least privileges. Defender for Endpoint leverages built-in roles within Microsoft Entra ID. Microsoft recommends [review the different roles that are available](/azure/active-directory/roles/permissions-reference) and choose the right one to solve your needs for each persona for this application. Some roles may need to be applied temporarily and removed after the deployment has been completed.
39
42
40
-
<br>
41
-
42
-
****
43
-
44
43
|Personas|Roles|Microsoft Entra role (if necessary)|Assign to|
45
44
|---|---|---|---|
46
45
|Security Administrator||||
47
46
|Security Analyst||||
48
47
|Endpoint Administrator||||
49
48
|Infrastructure Administrator||||
50
49
|Business Owner/Stakeholder||||
51
-
|
52
50
53
51
Microsoft recommends using [Privileged Identity Management](/azure/active-directory/active-directory-privileged-identity-management-configure) to manage your roles to provide additional auditing, control, and access review for users with directory permissions.
54
52
@@ -66,11 +64,12 @@ The following example table serves to identify the Cyber Defense Operations Cent
66
64
67
65
|Tier|Description|Permission Required|
68
66
|---|---|---|
69
-
|Tier 1|**Local security operations team / IT team** <p> This team usually triages and investigates alerts contained within their geolocation and escalates to Tier 2 in cases where an active remediation is required.||
70
-
|Tier 2|**Regional security operations team** <p> This team can see all the devices for their region and perform remediation actions.|View data|
71
-
|Tier 3|**Global security operations team** <p> This team consists of security experts and is authorized to see and perform all actions from the portal.|View data <p> Alerts investigation Active remediation actions <p> Alerts investigation Active remediation actions <p> Manage portal system settings <p> Manage security settings|
67
+
|Tier 1|**Local security operations team / IT team** <br/><br/> This team usually triages and investigates alerts contained within their geolocation and escalates to Tier 2 in cases where an active remediation is required.||
68
+
|Tier 2|**Regional security operations team** <br/><br/> This team can see all the devices for their region and perform remediation actions.|View data|
69
+
|Tier 3|**Global security operations team** <br/><br/> This team consists of security experts and is authorized to see and perform all actions from the portal.|View data <br/><br/> Alerts investigation Active remediation actions <br/><br/> Alerts investigation Active remediation actions <br/><br/> Manage portal system settings <br/><br/> Manage security settings|
72
70
73
71
## Next step
74
72
75
73
After assigning roles and permissions to view and manage Defender for Endpoint it's time for [Step 3 - Identify your architecture and choose your deployment method](deployment-strategy.md).
74
+
76
75
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
40
+
38
41
Large geo-distributed security operations teams typically adopt a tier-based model to assign and authorize access to security portals. Typical tiers include the following three levels:
39
42
40
43
|Tier|Description|
@@ -65,16 +68,16 @@ Before using RBAC, it's important that you understand the roles that can grant p
65
68
> [!WARNING]
66
69
> Before enabling the feature, it's important that you have a Global Administrator role or Security Administrator role in Microsoft Entra ID and that you have your Microsoft Entra groups ready to reduce the risk of being locked out of the portal.
67
70
68
-
When you first log in to the Microsoft Defender portal, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Microsoft Entra ID. Read only access is granted to users with a Security Reader role in Microsoft Entra ID.
71
+
When you first sign in to the Microsoft Defender portal, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Microsoft Entra ID. Read only access is granted to users with a Security Reader role in Microsoft Entra ID.
69
72
70
-
Someone with a Defender for Endpoint Global administrator role has unrestricted access to all devices, regardless of their device group association and the Microsoft Entra user groups assignments.
73
+
Someone with a Defender for Endpoint Global Administrator role has unrestricted access to all devices, regardless of their device group association and the Microsoft Entra user groups assignments.
71
74
72
75
> [!WARNING]
73
-
> Initially, only those with Microsoft Entra Global Administrator or Security Administrator rights will be able to create and assign roles in the Microsoft Defender portal, therefore, having the right groups ready in Microsoft Entra ID is important.
76
+
> Initially, only those with Microsoft Entra Global Administrator or Security Administrator rights can create and assign roles in the Microsoft Defender portal; therefore, having the right groups ready in Microsoft Entra ID is important.
74
77
>
75
-
> **Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Microsoft Entra Security reader role) to lose access until they are assigned to a role.**
78
+
> **Turning on role-based access control causes users with read-only permissions (for example, users assigned to Microsoft Entra Security reader role) to lose access until they are assigned to a role.**
76
79
>
77
-
> Users with admin permissions are automatically assigned the default built-in Defender for Endpoint global administrator role with full permissions. After opting in to use RBAC, you can assign additional users that are not Microsoft Entra Global or Security Administrators to the Defender for Endpoint global administrator role.
80
+
> Users with administrator permissions are automatically assigned the default built-in Defender for Endpoint Global Administrator role with full permissions. After opting in to use RBAC, you can assign additional users who aren't Microsoft Entra Global Administrators or Security Administrators to the Defender for Endpoint Global Administrator role.
78
81
>
79
82
> After opting in to use RBAC, you cannot revert to the initial roles as when you first logged into the portal.
0 commit comments